Frugality and threat modeling
Here are some thoughts on the value of adopting frugality within the Software Development Life Cycle (SDLC) and the role of threat modeling in facilitating this approach.
Headlines frequently highlight the imperative of cost reduction, often synonymous with workforce reductions, particularly within IT organisations. Simultaneously, the maintenance costs for software continue to rise. It is crucial to note that the expenses associated with fixing errors occurring in production environment are the highest in the entire Software Development Life Cycle (SDLC). Such error repair process not only disrupts the schedule for releasing new functionalities that could generate revenue but also incurs substantial costs, sometimes leading to job positions being eliminated.
According to the System Science Institue at IBM, the cost of fixing a bug that is found after product release is up to 100 times higher that one identified during the design phase.
Additionaly, based on the IBM report from 2023, the average cost of data breach reached approx. USD 4.5 million.
Nowadays product teams have to consider the costs of software development and maintenance. As I mentioned earlier, one of the most significant factors driving up costs is fixing errors in the production environment. One method to reduce the occurrence of errors in the production environment, especially when it comes to security flaws, is implementing threat modeling.
But what does the threat modeling really mean?
This article is not meant to create a tutorial on threat modeling. The intention is to decribe breifly how to get started with it. Please feel free to refer to the threat modeling resources below.
Threat modeling is a methodical approach to identifying and understanding potential threats within a system, whether it is a software application, cloud infrastructure, or a single feature. It entails examining how different parts of the system interoperate and identifying potential vulnerabilities. The primary goal of threat modeling is to identify threats and then reduce them and minimize risks, thus saving costs.
Get Kris’s stories in your inbox
Join Medium for free to get updates from this writer.
How to start? Whilst designing a new system, a new crucial feature or just improving the existing system, find time with your team and try to answer the followning questions that derive from Threat Modeling Manifesto:
- What are we working on?
- What can go wrong?
- What are we going to do about it?
- Did we a good job?
This is enough to start with. What you could do next is to systematize it by choosing the appropriate framework (the links are included in the reference section) or build your custom methodology.
Let’s face it. Any threat modeling session is not perfect and never will be. However it is always better to gain results from imperfect threat modeling sessions than having no session and no outcomes at all. According to the “The 2023 State of Threat Modeling” report, if you start conducting threat modeling sessions, you will have an advantage over nearly 50% of teams from other organisations who still do not conduct threat modeling sessions.
Be frugal and conduct threat modeling :)
References
